Agriculture Cybersecurity: 10 Practical Safeguards for Farms and Ag Businesses

Why agriculture cybersecurity deserves attention

Agricultural businesses do not need a fully automated farm to have meaningful cyber risk. Business email, online banking, supplier portals, remote support, and shared records can all affect whether orders, deliveries, and payments continue.

In July 2026, Coca-Cola disclosed a ransomware incident that temporarily suspended Fairlife's U.S. production; product quality and safety were unaffected. The Food and Ag-ISAC's August report counted 227 food and agriculture ransomware incidents through July, up 62% from the same period in 2025. These sector figures are context, not a prediction for an individual farm.

The same report describes supplier impersonation and ClickFix prompts that invent a technical problem and ask someone to run a command. A convincing invoice or support message deserves an independent check before anyone moves money or follows instructions.

Use the ten safeguards below to assign work with your IT provider. Keep the account lists, approvals, and recovery results together so you can review progress before the next busy season.

• Cybersecurity for agricultural retailers and farm-service businesses
• Agribusiness cybersecurity checklist before planting or harvest
• How to verify farm-equipment sellers and purchase requests
• Food and Ag-ISAC ransomware landscape
• Associated Press: Fairlife production disruption
• Food and Ag-ISAC 2026 State of the Threat report

1. Identify what must keep working

Start with business functions, not a list of software. Identify the systems behind receiving grain, scheduling deliveries, purchasing inputs, issuing invoices, paying suppliers, and accessing field or customer records.

For each essential function, record its owner, support contact, acceptable outage time, and dependencies. Include cloud services, internet access, printers, equipment-vendor connections, and the people who know how the process works.

Ask operations staff about systems the office may overlook, such as scale software, a service technician’s remote-access tool, or a tablet used for application records.

• Use the harvest cybersecurity checklist for recovery priorities

2. Protect email, banking, and administrator accounts

Give each person an individual account. Use unique passwords in a password manager, require multifactor authentication where supported, and separate administrator access from everyday email use.

For compatible services, consider phishing-resistant sign-in methods such as passkeys or security keys. Review recovery email addresses, phone numbers, and owners as well as the sign-in policy. An old employee’s recovery method can undermine an otherwise strong account.

Check that MFA is enforced for the required sign-ins, rather than merely available or enrolled. Keep the account list, administrator assignments, and recovery contacts current.

• Review the Business Security Baseline scope

3. Verify equipment purchases and payment changes independently

A familiar dealership name, professional invoice, or convincing website should not authorize a transfer by itself. Independently contact the real dealership and confirm the salesperson, equipment, stock or serial number, location, and payment recipient.

For supplier bank-detail changes, call a previously verified contact using the number already in your records. Do not use a replacement number supplied in the change request. Require a second approval for new payees, changed bank details, and larger transactions.

Keep a short record of who verified the request, which trusted contact method they used, and who approved it. A reply in the same email thread is not independent verification.

• Ten safety precautions for avoiding farm equipment scams
• FTC warning about farm equipment impersonation scams

4. Check what your business exposes to the internet

Start with public email records: they can identify the mail provider and authorized senders. A DMARC policy of p=none requests reporting, not quarantine or rejection. Have your administrator inventory legitimate invoicing and marketing senders before tightening enforcement. DMARC helps with exact-domain spoofing, not lookalike domains or a compromised real mailbox.

A new homepage can leave an older order portal or test site online. List current and former addresses, record who maintains them, and check whether they still hold customer or supplier information. Example: orders.example.com.

Check DNS records for canceled hosted services. A record pointing at an abandoned resource may create a takeover risk depending on the provider and configuration; verify ownership before deciding what to remove. Public VPN, Remote Desktop, and administrative login pages also need an owner, a business purpose, and separately verified access protections.

• Microsoft: staged DMARC configuration
• Microsoft: prevent subdomain takeover
• CISA: review internet-facing services
• Start the free Zero-Access Business Exposure Review

5. Make vendor remote access deliberate and accountable

Equipment dealers, software providers, and IT companies may need remote access. Document how they connect, what they can reach, who sponsors the relationship, and how access is removed.

Use named accounts, the narrowest necessary permissions, strong authentication where supported, and logging. Disable unnecessary access and use time-limited access where practical. Ask: “If we ended this vendor relationship today, could we remove every access path?” Include remote-support software and vendor cloud accounts in the answer.

Iowa State’s October 2026 Nature Food work proposes five regional agriculture cybersecurity centers and a coordinating hub, drawing on workshops with more than 150 participants. The proposal is not yet an operating nationwide service. For now, name who approves each vendor connection and who can end it.

Coordinate changes affecting equipment with the qualified vendor. Security work should not create an unsafe operating condition.

• Iowa State: proposed agriculture cybersecurity consortium
• CISA: securing remote-access software

6. Separate office systems from equipment controls

Operational technology includes systems that monitor or control irrigation, grain drying, refrigeration, environmental conditions, and other physical processes.

Have your IT provider and equipment specialist map connections to office devices, guest Wi-Fi, and remote support. Ask them to demonstrate how traffic is restricted to what the operation needs.

Protect configuration backups and document a safe operating response if connectivity is lost. Avoid unplanned scanning, software installation, or firmware changes on production controls.

• Review agriculture cybersecurity service boundaries

7. Fix the most consequential software weaknesses first

Keep routine updates moving, but prioritize issues according to exposure, exploitation evidence, and operational consequence. An exposed remote-access appliance may warrant faster action than a less consequential issue on an isolated device.

Have your provider identify affected products and versions, confirm vendor guidance, and keep a remediation list with an owner and completion date. For systems that cannot be patched immediately, record temporary protections and a date for the permanent correction.

• See how an independent security review works

8. Demonstrate recovery before you depend on it

Choose one important workflow, such as accessing customer orders or producing invoices, and test recovery in an appropriate isolated environment.

Have the person who uses the records confirm that restored data is usable. Record the elapsed time, missing items, application settings, licensing dependencies, and the people needed to bring the workflow back.

Protect backup administration separately and maintain copies that compromised production accounts cannot readily alter or delete. For cloud applications, confirm retention, export, and recovery responsibilities instead of assuming the subscription covers every loss.

• Test recovery before harvest

9. Train people on the requests they actually receive

Use scenarios that match agricultural work: a changed fertilizer invoice, an equipment deposit, a shared agronomy document, or an urgent request to reset a supplier-portal password.

Teach staff to verify unexpected requests through known channels and report mistakes quickly. Include suspicious texts and phone calls, not just email. A website asking someone to paste commands into a computer to complete a verification check should trigger a stop-and-report response.

Include seasonal staff, family members who help with administration, and employees using phones in the field. Make reporting simple and supportive.

• Online employee awareness training for agriculture teams

10. Rehearse a busy-day outage

Run a short discussion with this scenario: “Email and the order system are unavailable at 7 a.m., and deliveries are already arriving.” Decide who contacts IT, who can authorize containment, how employees communicate, and which activities can continue safely.

Keep essential contacts and approved fallback procedures outside the affected systems. If a payment may have gone to a fraudster, contact the financial institution immediately, preserve the messages and transaction details, and involve your response provider promptly when a technology compromise is suspected.

Keep the response plan, offline contacts, and assigned follow-up actions where the team can reach them during an outage.

• Free small-business incident response plan template

Nurseries, greenhouses and garden centers

Priorities differ across horticulture. A greenhouse depends on irrigation, ventilation, and environmental controls; a wholesale nursery needs plant-availability lists, customer orders, and delivery schedules; a garden center also needs checkout and inventory. Assign a recovery priority and support contact to each dependency.

Ask the equipment supplier who can view readings, change growing settings, and administer the remote portal. Confirm whether local controls continue without the internet, how staff can check actual conditions independently, and which supplier-approved fallback is safe. Do not disconnect live growing systems to practice an outage.

Before seasonal hiring, define access to plant orders, customer records, checkout administration, and supplier portals. Use individual accounts with end dates and a named removal owner. Transfer records and responsibilities before closing departing workers' accounts.

Practice a combined outage: the remote dashboard and email are unavailable during shipping week. Can the grower check conditions locally while the office finds today's plant orders and confirms delivery changes? Keep business-record recovery and equipment-configuration recovery separate, with qualified personnel responsible for each.

• NIST: operational technology security guidance
• NIST: effective OT backup management

Do you need another security platform?

Optional: if you are considering a new security platform, compare it with the tools already supplied by Microsoft 365, your IT provider, endpoint protection, and backup service. Identify the gap you need it to fill.

Ask each vendor for the same evidence, then pilot enrollment, alert routing, reporting, and an escalation using representative business systems before signing a long contract.

• Identity and email: supported MFA and administrator controls, enforced-policy reports, and account-recovery ownership.
• Endpoints and patching: supported and missing devices, enrollment coverage, update exceptions, and a named remediation owner.
• Public exposure and staff practice: asset ownership checks, relevant training scenarios, participation, and a process for acting on findings.
• Recovery: protected-copy coverage, failed-job follow-up, tested restoration, and clear cloud-data responsibilities.
• Response: monitoring hours, escalation times, containment authority, and which investigation or recovery work costs extra.
• Fit and exit: remote-site and seasonal-user support, explicit OT exclusions, data storage and access, retention, export, agent removal, and cancellation terms.

• NIST CSF 2.0 Small Business Quick-Start Guide
• Use the agribusiness checklist to record coverage gaps

Where should an agricultural business start?

This week, review critical accounts and payment-change procedures. Over the next two weeks, review public exposure and vendor access. Within 30 days, test one recovery workflow and rehearse an outage. Before each busy season, review staffing, equipment connections, and open findings.

Do not buy another platform simply because a checklist is long. First determine which safeguards are missing, which existing tools can provide them, and which results you can verify.

Common questions about agriculture cybersecurity

Related resources

• Agriculture Ransomware: Could Your Farm or Greenhouse Keep Working?
• USDA Warns of Produce Buyer Fraud: Verify Before You Ship
• Suspected Freezer Cyberattacks Hit Shops in Seven European Countries